prototype-html

Pass

Audited by Gen Agent Trust Hub on Oct 13, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill generates HTML files that reference external resources from well-known providers, specifically Tailwind CSS via cdn.tailwindcss.com and Font Awesome via cdnjs.cloudflare.com. Both are widely used and established service providers.
  • [DYNAMIC_EXECUTION]: The skill's primary function is to generate HTML files containing embedded JavaScript for UI interactions, such as modal management and SVG line drawing for feature annotations, based on the provided example template.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user requirements to populate the generated prototype. While it uses internal templates, there are no instructions to sanitize user-provided data before it is interpolated into the generated HTML structure, creating a surface for potential injection.
  • Ingestion points: User requirement descriptions provided at runtime via the prompt.
  • Boundary markers: None specified in the instructions to separate user input from the rest of the HTML template.
  • Capability inventory: Generates HTML files with embedded JavaScript based on assets/example.html.
  • Sanitization: No explicit validation or escaping of user input is instructed in SKILL.md.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 13, 2026, 10:59 AM